kaniko 在其构建上下文提取过程中存在 tar 归档路径遍历漏洞，允许在 github.com/chainguard-dev/kaniko 中目标目录之外写入文件。

该路径遍历漏洞允许攻击者通过操纵构建上下文，将文件写入到 Kaniko 容器镜像构建过程中的目标目录之外。攻击者可以利用此漏洞来覆盖重要系统文件、植入恶意代码或窃取敏感数据。例如，攻击者可能能够将恶意配置文件写入到容器的根目录，从而在容器运行时执行恶意操作。由于 Kaniko 广泛用于 CI/CD 管道中构建容器镜像，因此该漏洞的潜在影响范围非常广泛，可能影响整个软件供应链的安全。

Organizations heavily reliant on Kaniko for automated container image builds, particularly those using it within CI/CD pipelines, are at significant risk. Shared hosting environments where multiple users build images using a shared Kaniko instance are also vulnerable, as a malicious build from one user could potentially impact other users' images or the host system itself. Legacy Kaniko deployments using older versions are particularly susceptible.

• go / kaniko: Inspect build scripts and Dockerfiles for unusual file paths or references to external directories. Use go vet to scan Kaniko source code for potential path traversal vulnerabilities. • linux / server: Monitor build logs for unexpected file creation or modification in sensitive directories. Use auditd to track file access events within the Kaniko build environment.

auditctl -w /path/to/kaniko/build/directory -p wa -k kaniko_build

• generic web: If Kaniko is integrated into a web application, monitor access logs for requests containing suspicious path traversal sequences in the build context parameters.

grep '..\/' /var/log/nginx/access.log

1. 2026-03-10Disclosure

   disclosure

1. 已保留2026-02-27
2. 发布日期2026-03-10
3. 修改日期2026-03-23
4. EPSS 更新日期2026-03-23

最有效的缓解措施是立即升级到 Chainguard Kaniko 1.25.10 或更高版本。如果无法立即升级，可以考虑使用构建上下文隔离技术，限制 Kaniko 访问的文件和目录。此外，实施严格的输入验证和清理措施，以防止攻击者操纵构建上下文。监控 Kaniko 的日志文件，查找任何异常的文件写入活动。如果使用代理或 WAF，配置规则以阻止可疑的构建请求。